A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.
This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.
Is CVE-2026-34926 exploited?
Listed in the CISA KEV catalog on 2026-05-21.
Federal remediation due 2026-06-04.
Past that date by 72 days.
Public exploit code: none found in monitored sources.